ISJ speaks exclusively with Oonagh van den Berg, Founder and CEO of compliance and risk consultancy firm, Virtual Risk Solutions (VRS), and social enterprise, RAW Compliance.
How should organisations think about the relationship between compliance, cybersecurity and operational resilience in an increasingly complex threat environment?
For many years organisations treated compliance, cybersecurity and operational resilience as separate disciplines. Compliance interpreted regulations.
Cybersecurity protected technology. Operational resilience prepared for disruption.
Increasingly, regulators are making it clear that these are no longer independent functions – they are different lenses through which the same organisational capability is assessed.
A cyber-incident is no longer simply an IT problem. It is a governance issue, a regulatory issue, a financial crime issue, an operational resilience issue and often a reputational issue simultaneously.
The organisations that respond most effectively are those that stop asking, “Who owns this risk?” and instead ask, “How does the organisation collectively demonstrate that this risk is being identified, managed and evidenced?”
The common denominator across all three disciplines is evidence. Regulators increasingly expect organisations not simply to have policies and frameworks, but to demonstrate that controls operate effectively in practice. That requires connected data, clear governance, meaningful management information and continuous assurance.
Ultimately, compliance, cybersecurity and operational resilience should not compete for ownership – they should operate as an integrated system focused on protecting customers, maintaining trust and enabling the business to operate safely.
Where do you see the gaps between regulatory expectations and real-world practices within organisations today?
The biggest gap is no longer regulation itself – it is the ability to demonstrate effectiveness. Most organisations have invested heavily in frameworks, policies and governance documentation. Those remain important, but regulators are increasingly asking a different question: “Can you prove your controls are actually working?”
Unfortunately, many organisations still rely on fragmented spreadsheets, manual reporting and disconnected systems. Different functions often maintain different versions of the same information, making it difficult to create a coherent picture of organisational risk.
Another challenge is that risk functions continue to operate in organisational silos. Financial crime, cybersecurity, operational resilience, privacy, internal audit and enterprise risk frequently assess similar risks using different methodologies and different data sets.
The organisations making the greatest progress are moving away from framework-centric thinking towards evidence-centric governance, where data, technology and continuous monitoring provide a more dynamic view of organisational effectiveness.
How can boards and executives ensure they are asking the right questions about security, risk and compliance?
Boards should spend less time asking whether policies exist and more time asking whether they can trust the evidence they are receiving. Good governance is driven by curiosity rather than reassurance. Questions such as these are often more valuable than reviewing another dashboard filled with green indicators.
- How do we know these controls are working?
- What evidence supports this conclusion?
- Where are our biggest blind spots?
- Which risks are becoming more interconnected?
- If a regulator visited tomorrow, what evidence could we produce?
Boards should also challenge whether management information reflects real operational performance rather than reporting activity. Being busy is not the same as being effective. The quality of board oversight increasingly depends on the quality of the information that reaches the board.
What steps should organisations be taking to strengthen their defences while maintaining effective governance?
Technology is an important enabler, but governance must come first. Organisations should begin by understanding their critical services, critical risks and critical controls. Once these are clearly defined, they should establish consistent ownership, reliable data sources and measurable outcomes.
They should also invest in breaking down organisational barriers. Threat actors do not distinguish between cyber-risk, fraud, sanctions, operational resilience or third-party risk, and neither should organisational intelligence.
Finally, organisations should focus on continuous testing rather than periodic assurance. Controls that are only reviewed annually may not reflect the rapidly changing threat landscape. Strong governance is not about creating more documentation – it is about creating greater confidence in organisational decision-making.
How can teams move from working in silos to creating a unified approach to protecting organisations and stakeholders?
The biggest challenge is rarely technology. It is organisational design and culture. Different teams often collect similar information for different purposes, using different terminology and different reporting structures. This creates duplication, inconsistency and blind spots.
Organisations should instead identify common data, common risks and common control objectives across functions. Once teams begin sharing information rather than simply exchanging reports, they develop a much richer understanding of organisational risk.
Artificial intelligence will undoubtedly accelerate this shift by helping organisations connect previously fragmented information and identify relationships that humans may overlook. However, AI is only as effective as the governance surrounding it.
Ultimately, protecting organisations requires connected intelligence rather than isolated expertise.
The future belongs to organisations that can continuously demonstrate – not merely assume – that their governance, security and compliance capabilities are working together to deliver resilient outcomes.
That represents a fundamental shift from measuring activity to demonstrating effectiveness – and I believe it will define the next generation of governance.
About Oonagh van den Berg
Oonagh has more than 24 years of international experience in governance, risk, compliance and financial crime.
Having held senior leadership roles across global banking, fintech and digital assets, she specialises in helping organisations build data-driven, evidence-based compliance frameworks that stand up to regulatory scrutiny.
A best-selling Author of the ‘Modernising Compliance’ book series, a much sought after international keynote speaker and recognised thought leader, Oonagh is passionate about modernising compliance through AI, governance and practical innovation while making high-quality compliance education accessible worldwide.
Virtual Risk Solutions (VRS) and RAW Compliance